diff --git a/scripts/configure-system.sh b/scripts/configure-system.sh
index 32347ba..d69e21c 100755
--- a/scripts/configure-system.sh
+++ b/scripts/configure-system.sh
@@ -93,6 +93,20 @@ if [[ -d /arcline-debs ]] && ls /arcline-debs/*.deb >/dev/null 2>&1; then
     || warn "toolchain install incomplete (fix with: apt-get -f install)"
 fi
 
+# ── observability services (vendor debs from toolchain/build-vendor.sh) ─────
+# Only enabled when their binaries actually landed in the image.
+for svc_bin_unit in \
+  "/usr/sbin/grafana-server:grafana-server" \
+  "/usr/bin/loki:loki" \
+  "/usr/bin/promtail:promtail"; do
+  bin="${svc_bin_unit%%:*}"
+  unit="${svc_bin_unit##*:}"
+  if [[ -x "$bin" ]]; then
+    systemctl enable "$unit" 2>/dev/null || true
+    log "observability: enabled $unit ($bin present)"
+  fi
+done
+
 # ── optional upstream repos (grafana, loki) ─────────────────────────────────
 if [[ "$EXTRA_REPOS" == "1" ]]; then
   log "adding upstream observability repos (grafana, loki)"
diff --git a/toolchain/build-vendor.sh b/toolchain/build-vendor.sh
new file mode 100755
index 0000000..a32446b
--- /dev/null
+++ b/toolchain/build-vendor.sh
@@ -0,0 +1,105 @@
+#!/usr/bin/env bash
+# ─────────────────────────────────────────────────────────────────────────────
+# Arcline OS — vendor packaging (Grafana + Loki + Promtail .debs)
+#
+#   toolchain/build-vendor.sh
+#
+# Produces .debs for the observability components that are NOT in Debian main,
+# so the whole stack installs from build/debs/ without ARCLINE_EXTRA_REPOS:
+#
+#   grafana            official OSS .deb, vendored as-is
+#   arcline-loki       loki binary (GitHub release) → arcline-loki_<v>.deb
+#   arcline-promtail   promtail binary (same release) → arcline-promtail_<v>.deb
+#
+# Versions are pinned here and overridable via GRAFANA_VERSION / LOKI_VERSION.
+# Anything that cannot be downloaded is skipped with a warning — the OS build
+# must never break because a download failed (run again later to retry).
+# ─────────────────────────────────────────────────────────────────────────────
+set -euo pipefail
+source "$(dirname "${BASH_SOURCE[0]}")/../scripts/common.sh"
+
+GRAFANA_VERSION="${GRAFANA_VERSION:-11.3.1}"
+LOKI_VERSION="${LOKI_VERSION:-3.3.2}"
+ARCH="${ARCH:-amd64}"
+
+GRAFANA_DEB="grafana_${GRAFANA_VERSION}_${ARCH}.deb"
+GRAFANA_URL="https://dl.grafana.com/oss/release/${GRAFANA_DEB}"
+LOKI_URL="https://github.com/grafana/loki/releases/download/v${LOKI_VERSION}/loki-linux-${ARCH}.zip"
+PROMTAIL_URL="https://github.com/grafana/loki/releases/download/v${LOKI_VERSION}/promtail-linux-${ARCH}.zip"
+
+mkdir -p "$DEB_DIR" "$BUILD_DIR/vendor" "$BUILD_DIR/pkg"
+log "vendor build → $DEB_DIR (grafana $GRAFANA_VERSION, loki $LOKI_VERSION, arch $ARCH)"
+
+fetch() { # url dest → download if missing
+  local url="$1" dest="$2"
+  if [[ -f "$dest" ]]; then log "  cached: $(basename "$dest")"; return 0; fi
+  log "  downloading $(basename "$dest")"
+  curl -fsSL --retry 2 -o "$dest" "$url"
+}
+
+# ── grafana: vendor the official .deb as-is ─────────────────────────────────
+log "grafana"
+if fetch "$GRAFANA_URL" "$BUILD_DIR/vendor/$GRAFANA_DEB"; then
+  cp "$BUILD_DIR/vendor/$GRAFANA_DEB" "$DEB_DIR/"
+  log "  packaged: $GRAFANA_DEB"
+else
+  warn "grafana download failed (GRAFANA_VERSION=$GRAFANA_VERSION) — skipping"
+fi
+
+# ── helper: package a static binary as a .deb ───────────────────────────────
+package_binary() { # name url config_src service unit user
+  local name="$1" url="$2" cfg="$3" unit="$4" user="$5"
+  local zip="$BUILD_DIR/vendor/${name}-linux-${ARCH}.zip"
+  local bin_dir="$BUILD_DIR/pkg/$name"
+  local deb="${name}_${LOKI_VERSION}_${ARCH}.deb"
+
+  log "$name"
+  if ! fetch "$url" "$zip"; then
+    warn "$name download failed (LOKI_VERSION=$LOKI_VERSION) — skipping"
+    return 1
+  fi
+  local exe
+  exe="$(unzip -Z1 "$zip" | grep -E "${name}(-linux-${ARCH})?$" | head -1 || true)"
+  [[ -n "$exe" ]] || { warn "$name: binary not found in archive — skipping"; return 1; }
+
+  rm -rf "$bin_dir"
+  mkdir -p "$bin_dir/DEBIAN" "$bin_dir/usr/bin" \
+           "$bin_dir/etc/${name}" "$bin_dir/usr/lib/systemd/system" \
+           "$bin_dir/var/lib/${name}"
+  unzip -p "$zip" "$exe" > "$bin_dir/usr/bin/$name"
+  chmod 0755 "$bin_dir/usr/bin/$name"
+
+  cp "$cfg"  "$bin_dir/etc/${name}/${name}.yml"
+  cp "$unit" "$bin_dir/usr/lib/systemd/system/${name}.service"
+
+  cat > "$bin_dir/DEBIAN/control" <<EOF
+Package: arcline-$name
+Version: $LOKI_VERSION
+Section: admin
+Priority: optional
+Architecture: $ARCH
+Maintainer: Arcline IT LLC <os@arcline.it>
+Homepage: https://grafana.com
+Description: $name for Arcline OS observability stack
+ Bundled as part of the Arcline OS vendor packaging. Config lives in
+ /etc/$name/$name.yml (provisioned from overlays/server).
+EOF
+  cat > "$bin_dir/DEBIAN/postinst" <<EOF
+#!/bin/sh
+set -e
+if ! getent group $user >/dev/null; then addgroup --system $user; fi
+if ! getent passwd $user >/dev/null; then adduser --system --ingroup $user --home /var/lib/$name --no-create-home $user; fi
+chown -R $user:$user /var/lib/$name 2>/dev/null || true
+#debian/configure
+EOF
+  chmod 0755 "$bin_dir/DEBIAN/postinst"
+
+  dpkg-deb --build --root-owner-group "$bin_dir" "$DEB_DIR/$deb" >/dev/null
+  log "  packaged: $deb"
+}
+
+# ── loki + promtail from the same GitHub release ────────────────────────────
+package_binary loki     "$LOKI_URL"     "$ROOT/overlays/server/etc/loki/loki.yml"     "$ROOT/toolchain/vendor/loki/loki.service"     loki     || true
+package_binary promtail "$PROMTAIL_URL" "$ROOT/overlays/server/etc/promtail/promtail.yml" "$ROOT/toolchain/vendor/promtail/promtail.service" root || true
+
+log "vendor packaging complete — see $DEB_DIR"
diff --git a/toolchain/vendor/loki/loki.service b/toolchain/vendor/loki/loki.service
new file mode 100644
index 0000000..2822660
--- /dev/null
+++ b/toolchain/vendor/loki/loki.service
@@ -0,0 +1,17 @@
+[Unit]
+Description=Arcline Loki log aggregation
+Documentation=https://grafana.com/docs/loki/latest/
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+User=loki
+Group=loki
+ExecStart=/usr/bin/loki -config.file=/etc/loki/loki.yml
+Restart=on-failure
+RestartSec=5
+LimitNOFILE=65535
+
+[Install]
+WantedBy=multi-user.target
diff --git a/toolchain/vendor/promtail/promtail.service b/toolchain/vendor/promtail/promtail.service
new file mode 100644
index 0000000..1414337
--- /dev/null
+++ b/toolchain/vendor/promtail/promtail.service
@@ -0,0 +1,15 @@
+[Unit]
+Description=Arcline Promtail log shipper
+Documentation=https://grafana.com/docs/loki/latest/clients/promtail/
+After=network-online.target loki.service
+Wants=network-online.target
+
+[Service]
+Type=simple
+ExecStart=/usr/bin/promtail -config.file=/etc/promtail/promtail.yml
+Restart=on-failure
+RestartSec=5
+LimitNOFILE=65535
+
+[Install]
+WantedBy=multi-user.target